All about Windows Live Messenger, providing news, reviews, support, and information for developing and improving your Messenger experience.
At some stage you will need to use URL and UTF-8 encoding, you need to do so for friendly names, phone numbers, etc. Messages should be UTF-8 encoded as well, this is specified by “charset=UTF-8″ in the content-type header. URL encoding should come before UTF-8 encoding, and UTF-8 decoding should come before URL decoding.
Update: I have removed the code from this page and have since uploaded it here for URL and here for UTF-8.
It has been reported that the problem exists in the MSN client during file transfer invitation requests. The client improperly processes incoming requests and may send sensitive data such as the IP address of the client to the remote host without first identifying that host. The expected behavior is that the client must accept the file transfer prior to revealing its IP address. However, by exploiting this weakness, it is possible to obtain the client IP address prior to the client user accepting the file transfer request. This presents a security threat because it will allow an attacker to enumerate IP addresses of client users.
This information could be used to launch direct attacks against the client system and network.
MSN Messenger versions 6.0.0602 and prior and all versions of Windows Messenger have been reported to be prone to this issue. Other versions of MSN Messenger could be affected as well.
